Loading KDF Hash Generator...
Derive password hashes with modern, memory-hard key-derivation functions - Argon2id/i/d, PBKDF2, and scrypt. Runs entirely in your browser.
Generate password hashes with Argon2id/i/d, PBKDF2, and scrypt - the modern, memory-hard key-derivation functions. Tunable parameters, runs in your browser.
Passwords should never be stored with a plain hash like MD5 or SHA-256. Key-derivation functions (KDFs) such as Argon2, scrypt, and PBKDF2 deliberately make hashing slow and, for Argon2/scrypt, memory-hard, so attackers cannot brute force them efficiently on GPUs or ASICs. This tool generates hashes with all three families, with tunable cost parameters, and returns both the raw hex and (for Argon2) the standard PHC-encoded string you can store directly. Everything is computed locally via WebAssembly.
Input:
password + salt, Argon2id (t=3, m=64MB, p=1)
Output:
$argon2id$v=19$m=65536,t=3,p=1$c29tZXNhbHQ$...
Which algorithm should I use?
Argon2id is the current best practice for password hashing. scrypt is a strong, well-tested alternative. PBKDF2 is widely supported and FIPS-friendly but more vulnerable to GPU cracking, so use a high iteration count.
What parameters are safe?
As a starting point: Argon2id with 19 MiB+ memory and a few iterations, scrypt with N=16384+, or PBKDF2-HMAC-SHA256 with 600,000+ iterations. Tune so a single hash takes a few hundred milliseconds.
What is the encoded Argon2 string?
It is the PHC format ($argon2id$v=...$m=...,t=...,p=...$salt$hash) that stores the algorithm, parameters, salt, and hash together, so a verifier needs only that one string.
Is my password sent anywhere?
No. All key derivation runs in your browser with WebAssembly; nothing is uploaded.